398984b3f83181088396b031a5c80dcc486ad12c278a3b846a424654798fa3ad

Analysis

max time kernel
109s
max time network
36s
platform
windows7_x64
resource
win7-20230220-en
resource tags

arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
submitted
22/03/2023, 00:52

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

P4rr0tCr4sh3r_V1.exe
Size

139KB
MD5

b0e20c5a66c9ea6a84af3297c43e0ab6
SHA1

2aef2f78d20bb83f623f9af561db6b764a3ccaf2
SHA256

398984b3f83181088396b031a5c80dcc486ad12c278a3b846a424654798fa3ad
SHA512

fc68923e099d5ab15ecf0531b110d905a71ab60e11c6df0d02e23e7d7054177680f00a39ee7b223377855005b6a917cc3cc40877b3c453d4140c63ec7bf2e45c
SSDEEP

1536:agyJWH4azSaXtJ+WVkADPQHQBK8JEOROwHX9rdvrqLy:agWWB+gkArQHO1OcrxUy

Score

4^/10

Malware Config

Signatures

Drops file in Windows directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe
File opened for modification	C:\Windows\Debug\WIA\wiatrace.log	mspaint.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	2008	shutdown.exe
Token: SeRemoteShutdownPrivilege	2008	shutdown.exe

Suspicious use of SetWindowsHookEx 64 IoCs

pid	Process
1924	mspaint.exe
1504	mspaint.exe
1400	mspaint.exe
1464	wordpad.exe
1464	wordpad.exe
1400	mspaint.exe
1504	mspaint.exe
2112	wordpad.exe
696	wordpad.exe
2188	mspaint.exe
1588	mspaint.exe
2112	wordpad.exe
2112	wordpad.exe
2060	mspaint.exe
1828	mspaint.exe
2112	wordpad.exe
2112	wordpad.exe
696	wordpad.exe
1224	mspaint.exe
696	wordpad.exe
1924	mspaint.exe
2392	wordpad.exe
2412	wordpad.exe
2316	mspaint.exe
1464	wordpad.exe
2392	wordpad.exe
2412	wordpad.exe
2956	mspaint.exe
2504	mspaint.exe
2692	mspaint.exe
952	wordpad.exe
2188	mspaint.exe
2060	mspaint.exe
3192	mspaint.exe
2448	mspaint.exe
2808	mspaint.exe
2748	mspaint.exe
2564	mspaint.exe
2624	mspaint.exe
1612	mspaint.exe
952	wordpad.exe
1828	mspaint.exe
2684	wordpad.exe
3348	mspaint.exe
3604	mspaint.exe
3660	mspaint.exe
4660	mspaint.exe
3724	mspaint.exe
3780	mspaint.exe
3368	wordpad.exe
3540	mspaint.exe
2684	wordpad.exe
3684	wordpad.exe
1588	mspaint.exe
3936	mspaint.exe
4604	mspaint.exe
2316	mspaint.exe
3368	wordpad.exe
4112	mspaint.exe
4232	mspaint.exe
4300	mspaint.exe
3996	wordpad.exe
1224	mspaint.exe
4964	wordpad.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1712 wrote to memory of 1056	1712	P4rr0tCr4sh3r_V1.exe	29
PID 1712 wrote to memory of 1056	1712	P4rr0tCr4sh3r_V1.exe	29
PID 1712 wrote to memory of 1056	1712	P4rr0tCr4sh3r_V1.exe	29
PID 1056 wrote to memory of 2008	1056	cmd.exe	30
PID 1056 wrote to memory of 2008	1056	cmd.exe	30
PID 1056 wrote to memory of 2008	1056	cmd.exe	30
PID 1056 wrote to memory of 672	1056	cmd.exe	32
PID 1056 wrote to memory of 672	1056	cmd.exe	32
PID 1056 wrote to memory of 672	1056	cmd.exe	32
PID 1056 wrote to memory of 1924	1056	cmd.exe	33
PID 1056 wrote to memory of 1924	1056	cmd.exe	33
PID 1056 wrote to memory of 1924	1056	cmd.exe	33
PID 1056 wrote to memory of 1288	1056	cmd.exe	35
PID 1056 wrote to memory of 1288	1056	cmd.exe	35
PID 1056 wrote to memory of 1288	1056	cmd.exe	35
PID 1056 wrote to memory of 512	1056	cmd.exe	36
PID 1056 wrote to memory of 512	1056	cmd.exe	36
PID 1056 wrote to memory of 512	1056	cmd.exe	36
PID 1056 wrote to memory of 988	1056	cmd.exe	37
PID 1056 wrote to memory of 988	1056	cmd.exe	37
PID 1056 wrote to memory of 988	1056	cmd.exe	37
PID 1056 wrote to memory of 1172	1056	cmd.exe	50
PID 1056 wrote to memory of 1172	1056	cmd.exe	50
PID 1056 wrote to memory of 1172	1056	cmd.exe	50
PID 1056 wrote to memory of 2016	1056	cmd.exe	49
PID 1056 wrote to memory of 2016	1056	cmd.exe	49
PID 1056 wrote to memory of 2016	1056	cmd.exe	49
PID 1056 wrote to memory of 1980	1056	cmd.exe	42
PID 1056 wrote to memory of 1980	1056	cmd.exe	42
PID 1056 wrote to memory of 1980	1056	cmd.exe	42
PID 1056 wrote to memory of 1504	1056	cmd.exe	38
PID 1056 wrote to memory of 1504	1056	cmd.exe	38
PID 1056 wrote to memory of 1504	1056	cmd.exe	38
PID 1056 wrote to memory of 240	1056	cmd.exe	41
PID 1056 wrote to memory of 240	1056	cmd.exe	41
PID 1056 wrote to memory of 240	1056	cmd.exe	41
PID 1056 wrote to memory of 1304	1056	cmd.exe	39
PID 1056 wrote to memory of 1304	1056	cmd.exe	39
PID 1056 wrote to memory of 1304	1056	cmd.exe	39
PID 1056 wrote to memory of 828	1056	cmd.exe	48
PID 1056 wrote to memory of 828	1056	cmd.exe	48
PID 1056 wrote to memory of 828	1056	cmd.exe	48
PID 1056 wrote to memory of 576	1056	cmd.exe	43
PID 1056 wrote to memory of 576	1056	cmd.exe	43
PID 1056 wrote to memory of 576	1056	cmd.exe	43
PID 1056 wrote to memory of 564	1056	cmd.exe	46
PID 1056 wrote to memory of 564	1056	cmd.exe	46
PID 1056 wrote to memory of 564	1056	cmd.exe	46
PID 1056 wrote to memory of 2032	1056	cmd.exe	45
PID 1056 wrote to memory of 2032	1056	cmd.exe	45
PID 1056 wrote to memory of 2032	1056	cmd.exe	45
PID 1056 wrote to memory of 1400	1056	cmd.exe	44
PID 1056 wrote to memory of 1400	1056	cmd.exe	44
PID 1056 wrote to memory of 1400	1056	cmd.exe	44
PID 576 wrote to memory of 696	576	write.exe	52
PID 576 wrote to memory of 696	576	write.exe	52
PID 576 wrote to memory of 696	576	write.exe	52
PID 1172 wrote to memory of 1464	1172	write.exe	51
PID 1172 wrote to memory of 1464	1172	write.exe	51
PID 1172 wrote to memory of 1464	1172	write.exe	51
PID 1056 wrote to memory of 288	1056	cmd.exe	53
PID 1056 wrote to memory of 288	1056	cmd.exe	53
PID 1056 wrote to memory of 288	1056	cmd.exe	53
PID 1056 wrote to memory of 1816	1056	cmd.exe	54

C:\Users\Admin\AppData\Local\Temp\P4rr0tCr4sh3r_V1.exe
"C:\Users\Admin\AppData\Local\Temp\P4rr0tCr4sh3r_V1.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1712
- C:\Windows\system32\cmd.exe
  cmd /c ""C:\Users\Admin\AppData\Local\Temp\639.tmp\P4rr0tCr4sh3r.bat" "C:\Users\Admin\AppData\Local\Temp\P4rr0tCr4sh3r_V1.exe""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1056
- - C:\Windows\system32\shutdown.exe
    shutdown.exe -s -t 60 -c "You have been crashed by P4rr0tCr4sh3r, say goodbye to your pc in the next 1 min :D"
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:2008
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:672
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1924
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1288
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:512
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:988
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1504
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1304
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:240
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1980
- - C:\Windows\system32\write.exe
    write
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:576
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:696
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1400
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2032
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:564
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:828
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2016
- - C:\Windows\system32\write.exe
    write
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1172
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:1464
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:288
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1816
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:1704
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:1420
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2112
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:432
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1860
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:1372
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1984
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1588
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:384
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:1680
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:952
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:1316
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:556
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1404
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1044
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1828
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:1068
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:1716
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2392
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:1764
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1724
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1168
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:852
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2004
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2412
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2012
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1996
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1740
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:1224
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2060
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2076
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2104
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2128
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2140
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:2684
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2148
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2168
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2188
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2200
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2212
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2228
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2240
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3368
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2268
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2280
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2316
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2372
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2380
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2740
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2796
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2808
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2788
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2780
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4812
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2772
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2764
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2756
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2748
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2732
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2724
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5072
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2716
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2708
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2700
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2692
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2676
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2668
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2660
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4956
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2652
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2644
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2632
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2624
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2616
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2608
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2600
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5104
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2592
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2584
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2572
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2564
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2556
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2548
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2540
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4948
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2532
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2520
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2512
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2504
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2496
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2488
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2480
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4088
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2472
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2464
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2456
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:2448
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2436
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2428
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2420
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3684
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2404
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2984
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2996
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:3996
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2972
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2964
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:2956
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3044
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:2948
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2940
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2920
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4804
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2908
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2900
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2884
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3056
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:1612
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2184
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3076
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3096
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3112
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4248
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3140
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3160
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3192
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3208
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3236
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3256
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3288
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4972
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3300
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3316
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3348
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3380
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3428
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3436
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3472
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4052
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3508
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3532
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3644
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3788
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3780
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3772
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3764
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3756
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5492
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3748
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3740
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3732
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3724
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3716
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3708
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3700
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5592
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3692
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3676
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3668
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3660
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3652
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3636
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5616
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3628
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3620
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3612
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3604
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3596
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3588
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3580
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5368
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3572
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3564
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3548
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Suspicious use of SetWindowsHookEx
    PID:3540
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3864
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3880
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3892
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5164
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3904
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:3936
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3972
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3920
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4008
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4020
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4036
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      Suspicious use of SetWindowsHookEx
      PID:4964
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4060
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4332
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4344
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6016
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4320
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4312
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4300
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4292
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4280
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4272
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5416
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4264
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4256
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4240
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4232
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4224
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4216
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4208
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:584
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4200
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4192
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4184
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:4176
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4168
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4160
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4152
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6024
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4144
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4136
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4128
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4112
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4104
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4408
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3472
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4044
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6008
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:3364
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:3556
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3248
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:3008
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1716
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2144
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2088
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5752
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2040
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1680
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1380
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:2344
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4076
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:4464
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4456
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4504
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4536
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4668
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4716
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4660
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4652
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4644
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4636
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6148
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4628
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4620
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4612
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    - Suspicious use of SetWindowsHookEx
    PID:4604
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4596
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4588
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4580
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5560
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4552
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4876
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4860
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4852
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:4844
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4836
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4828
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4820
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6240
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4796
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4916
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4908
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6276
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5000
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:5028
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5048
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:5088
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5080
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3116
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6712
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4444
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:4428
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:4708
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3824
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2780
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:5144
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:5184
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6920
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:5200
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5232
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:5276
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5296
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5328
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:5396
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:5428
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:7444
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:5472
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5500
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:5572
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5624
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5644
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:5772
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:5840
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:7400
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:5868
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:5896
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:5968
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6048
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6116
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:1420
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:6168
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:7932
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:6212
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6248
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:6296
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6392
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6464
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:6536
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:6580
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:4988
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:6608
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6724
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6744
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6752
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:6732
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:6772
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:6804
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:8456
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:6816
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6896
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:6960
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7024
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7032
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7128
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:6408
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:8680
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:3376
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7220
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7408
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7464
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7492
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7500
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:7584
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:8924
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:7644
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7676
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:7724
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7780
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7824
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7864
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:7944
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:9160
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:7968
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7980
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:8008
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8120
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8152
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8160
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:7184
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:8516
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:7200
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8200
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:8232
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8260
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8284
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8364
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:8412
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6032
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8428
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:8420
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:8500
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8552
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8572
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8616
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:8632
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6228
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:8656
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8736
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:8752
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:8800
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8840
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8852
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:8860
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:9456
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:8888
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8972
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:8984
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9020
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:9036
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9064
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:9096
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:9660
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9124
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9172
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:9192
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5064
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4936
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:2544
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:8668
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:9836
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:5600
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:3580
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:5740
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:3640
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4580
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:4100
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:4924
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10044
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:4040
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:6268
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:4348
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4208
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4640
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:6936
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:9260
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10216
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9280
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9324
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:9332
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9356
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:9380
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9436
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:9468
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10248
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9492
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9516
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:9528
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9564
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:9588
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9628
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:9680
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10436
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9716
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9728
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:9752
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9788
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:9800
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9816
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:9872
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10608
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9892
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9908
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:9928
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9948
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:9980
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10000
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10056
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10800
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:10072
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10084
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:10112
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10148
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:10176
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10196
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10228
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:10980
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9572
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9580
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:5432
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:4980
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8496
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8440
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10256
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:11216
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:10268
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10280
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:10312
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10368
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:10392
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10412
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10452
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:6036
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:10460
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10472
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:10500
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10540
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:10564
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10580
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10632
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:11400
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:10652
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10660
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:10688
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10732
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:10760
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10772
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10816
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:11608
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:10828
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10856
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:10884
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10944
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:10952
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10992
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11008
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:11912
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11024
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11064
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:11096
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11140
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:11172
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:11188
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11228
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:12184
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11252
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8672
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:10388
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7944
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:10844
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7188
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10724
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:11712
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:9452
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9140
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:11288
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11320
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:11344
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:11368
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11408
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:12464
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11420
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11456
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:11468
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11520
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:11560
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:11584
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11636
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:12740
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11648
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11660
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:11700
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11756
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:11796
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:11884
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11924
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:12968
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11956
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11980
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:11996
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12064
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:12104
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:12164
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12208
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:13168
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12216
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12272
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:11600
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:5704
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:12080
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9260
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12308
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:9680
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12324
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12332
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:12364
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12404
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:12432
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:12456
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12488
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:13360
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12544
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12572
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:12600
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12656
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:12688
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12712
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:13548
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12768
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12788
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:12808
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12836
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:12864
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:12916
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12936
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:13756
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12980
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12992
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:13004
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13044
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13084
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:13112
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:13140
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:14052
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:13176
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:13192
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:13208
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13244
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13264
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:10428
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12524
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:14292
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11616
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12680
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:12380
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11212
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13176
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:13320
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:13344
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:13564
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:13368
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:13400
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:13416
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13488
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13512
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:13520
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:13592
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:14460
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:13600
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:13628
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:13680
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:13736
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13764
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:13804
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:13840
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:14652
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:13864
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:13908
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:13960
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14000
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:14028
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:14060
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14076
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:14848
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:14100
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14128
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    - Drops file in Windows directory
    PID:14180
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14200
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:14252
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:14268
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14300
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:15024
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:14308
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10456
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:13568
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11388
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:1760
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:11008
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14276
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:15232
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:11228
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14340
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:14368
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14408
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:14428
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:14440
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14488
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:11640
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:14500
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14528
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:14552
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14572
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:14600
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:14632
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14668
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:5984
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:14692
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14712
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:14724
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14768
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:14784
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:14808
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14828
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:2092
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:14860
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14872
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:14908
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14928
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:14984
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:15004
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:15036
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:2844
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:15068
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:15084
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:15120
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:15156
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:15180
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:15212
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:15244
  - - C:\Program Files\Windows NT\Accessories\wordpad.exe
      "C:\Program Files\Windows NT\Accessories\wordpad.exe"
      4⤵
      PID:7584
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:15264
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:15280
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:15320
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14484
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:12452
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:14508
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14384
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12956
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14900
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1220
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:6944
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:6988
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7060
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11060
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:1064
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11136
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:7720
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:7820
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:8116
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:15352
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:8532
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12488
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1340
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1528
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:11396
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2660
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7984
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3700
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2980
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:11928
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:15052
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2336
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2008
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8332
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11576
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:7980
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:12072
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:13744
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14048
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:5984
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7712
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:11136
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:12428
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:7108
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:13140
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:12568
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13544
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:8976
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:3124
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:2220
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:10108
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:12708
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:14936
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:7804
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9308
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:2980
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:8972
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:8992
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:1728
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:2580
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4584
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7668
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:8404
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:7980
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:9856
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:12556
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:10752
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:4156
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:7712
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:10016
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:10028
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:13596
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:12424
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9172
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:13260
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:13288
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:9232
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:8976
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:13844
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:10380
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1528
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:2336
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:9824
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:14284
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:5996
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:14936
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:8608
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:9308
- - C:\Windows\system32\calc.exe
    calc
    3⤵
    PID:9536
- - C:\Windows\system32\control.exe
    control
    3⤵
    PID:11452
- - C:\Windows\system32\write.exe
    write
    3⤵
    PID:12096
- - C:\Windows\explorer.exe
    explorer
    3⤵
    PID:7848
- - C:\Windows\system32\cmd.exe
    cmd
    3⤵
    PID:1728
- - C:\Windows\system32\mspaint.exe
    mspaint
    3⤵
    PID:11928
- - C:\Windows\system32\notepad.exe
    notepad
    3⤵
    PID:1956

C:\Windows\system32\conhost.exe
\??\C:\Windows\system32\conhost.exe "-19410130021126391827-829428536-2132285121966265172793178202-1488183918759118528"
1⤵
PID:2004

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:13504

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\639.tmp\P4rr0tCr4sh3r.bat

Filesize
253B

MD5
690b14eb0768a65feb6b5b20a73fa0ba

SHA1
8a0f9bde36eb729a701041a84d3cacdc36b10185

SHA256
613219bfb9e8d14af0ff1a036000037370505d2d1c0a567e4119b04de96be15f

SHA512
e998df8ea65aa6c05fd96584c8d4d1e26e7805b9833c38ed7bc1c15ef1f08e9239489aee5ac23ea24f75dd688ab5ab0600e2420fc4a9aec0e36590cc59ce8270

Download Submit
C:\Users\Admin\AppData\Local\Temp\639.tmp\P4rr0tCr4sh3r.bat

Filesize
253B

MD5
690b14eb0768a65feb6b5b20a73fa0ba

SHA1
8a0f9bde36eb729a701041a84d3cacdc36b10185

SHA256
613219bfb9e8d14af0ff1a036000037370505d2d1c0a567e4119b04de96be15f

SHA512
e998df8ea65aa6c05fd96584c8d4d1e26e7805b9833c38ed7bc1c15ef1f08e9239489aee5ac23ea24f75dd688ab5ab0600e2420fc4a9aec0e36590cc59ce8270

Download Submit
C:\Windows\system32\spool\DRIVERS\x64\3\mxdwdui.BUD

Filesize
56KB

MD5
bd72dcf1083b6e22ccbfa0e8e27fb1e0

SHA1
3fd23d4f14da768da7b8364d74c54932d704e74e

SHA256
90f44f69950a796ab46ff09181585ac9dabf21271f16ebb9ea385c957e5955c1

SHA512
72360ab4078ad5e0152324f9a856b3396e2d0247f7f95ac8a5a53a25126ac3cff567cc523849e28d92a99730ee8ffb30366f09c428258f93a5cca6d0c5905562

Download Submit
memory/1224-73-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/1224-127-0x0000000001D80000-0x0000000001D81000-memory.dmp

Filesize
4KB

Download
memory/1400-65-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/1400-107-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/1504-108-0x0000000002240000-0x0000000002241000-memory.dmp

Filesize
4KB

Download
memory/1504-66-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/1588-71-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/1588-124-0x0000000001EE0000-0x0000000001EE1000-memory.dmp

Filesize
4KB

Download
memory/1612-83-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/1828-70-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/1828-121-0x0000000001D00000-0x0000000001D01000-memory.dmp

Filesize
4KB

Download
memory/1924-113-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/1924-63-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2060-119-0x00000000021C0000-0x00000000021C1000-memory.dmp

Filesize
4KB

Download
memory/2060-69-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2112-67-0x0000000001F50000-0x0000000001F51000-memory.dmp

Filesize
4KB

Download
memory/2188-117-0x0000000002140000-0x0000000002141000-memory.dmp

Filesize
4KB

Download
memory/2188-68-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2316-125-0x0000000001E00000-0x0000000001E01000-memory.dmp

Filesize
4KB

Download
memory/2316-72-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2344-98-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2448-78-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2504-75-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2564-79-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2624-80-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2692-74-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2748-81-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2808-82-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/2956-76-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3008-94-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3192-77-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3348-84-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3540-90-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3604-85-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3660-86-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3724-87-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3780-89-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/3936-92-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4112-95-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4176-99-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4232-97-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4300-96-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4348-126-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4464-93-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4604-91-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4660-88-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4708-102-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/4844-100-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/5028-101-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/5276-103-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/5572-104-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/5740-123-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/5968-105-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/6296-106-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/6732-109-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/6960-110-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/7408-111-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/7724-112-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/8008-114-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/8232-115-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/8500-116-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/8752-118-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/8984-120-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download
memory/9192-122-0x000007FEFACF0000-0x000007FEFAD3C000-memory.dmp

Filesize
304KB

Download